- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Sample JSON Path Expressions for Manual Entry
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for JSON Parser Field Extractions and Enrichment Mapping
- Extract Fields Using Regular Expressions
- Reserved Fields
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Parsers
- Tokenize Non-Standard Log Files
- Duplicate a Parser
- Enable or Disable Parsers
- Parser Updates
- Supported Vendors and Products
- Live Tail
- Enrichments
- Event Filtering
- Log Stream APIs
Customize a Default Parser
When you customize a default parser, you cannot make changes to the existing configuration. However, you can customize the configuration by adding additional parser conditions, field mapping, and event builder rules. These customized parsers do not require effort to maintain. When a new Exabeam content package refreshes parsers in your environment, the default aspects of the customized parsers are updated automatically, but your custom updates persist unchanged.
To customize a default parser:
On the Parsers Overview tab of the Log Stream home page, click the Options (
) menu on the default parser you want to customize, and select Customize. Alternately, you can click View Details to open the Parser Details page and select the Customize option from the toolbar at the top.
Add sample log lines, change the parser conditions, activity type, time format, associated vendor and product, field mapping, and event builder rules. Click Next at each step, until you reach the last step.
Note
See Create a Custom Parser for detailed information about each step.
Click Finish and Enable.
The customized parser appears in the list on the Parsers Overview tab with a Customize Default icon (
) in the Type column